Transcript
Maria Varmazas (0:02)
You're listening to the Cyberwire Network powered by N2K.
Gianna Whitfer (0:09)
Gianna Whitfer here, co host of the Breaking through in Cybersecurity marketing podcast on N2K CyberWire Network. Here to interrupt your Thanksgiving break with just one little ad. We are hosting Cyber Marketing Con, a conference for marketers and go to market in the business side of cybersecurity this December 8th through 11th in the beautiful city of Philadelphia, Pennsylvania and also virtually get your ticket at cybermarketingconference.com or through our main website cybersecuritymarketingsociety.com.
Dave Buettner (0:47)
Hey everybody, Dave here. I want to talk about our sponsor, LegalZoom. You know, I started my first business back in the early 90s and oh what I would have done to have been able to have the services of an organization like LegalZoom back then. Just getting all of those business ducks in a row, all of that technical stuff, the legal stuff, the registrations of the business, the taxes, all of those things that you need to go through when you're starting a business, the hard stuff, the stuff that sucks up your time when you just want to get that business launched and out there. Well, LegalZoom has everything you need to launch, run and protect your business all in one place and they save you from wasting hours making sense of all that legal stuff. Launch, run and protect your business. To make it Official today@legalzoom.com you can use promo code CYBER10 to get 10% off any LegalZoom business information product, excluding subscriptions and renewals that expires at the end of this year. Get everything you need from set up to success@legalzoom.com and use promo code CYBERTEN, that's legalzoom.com and promo code CYBER10. Legalzoom provides access to independent attorneys and self service tools. Legalzoom is not a law firm and does not provide legal advice except where authorized through its subsidiary law firm LZ Legal Services llc.
Maria Varmazas (2:32)
Smashing Cybercrime syndicates Cybervolt goes global Tech troubles mostly resolved. A malware web weaved by salt typhoon targets global sectors Love at first exploit ransomware attack on blue yonder brews trouble. Google faces a UK court battle, lateral moves and lost data. And I sit down with Clemence Poirier, Senior Cyber Defense Researcher at the center for Security Studies at ETH Zurich to discuss cybersecurity attacks in space. And finally, a cybersecurity sales pitch goes rogue. Today is November 26, 2024. I'm Maria Varmazas, host of the T Minus Space daily podcast in for Dave Buettner and this is your Cyberwire Intel Brief Thai authorities dismantled two sophisticated Chinese operated cybercrime syndicates responsible for extensive fraudulent activities. The first Syndicate utilized over 10,000 phone numbers with Bangkok's 02 area code to execute more than 700 million scam calls within three days promoting fraudulent investment schemes. Investigations revealed connections to three companies linked to Chinese nationals, leading to arrest warrants for 24 suspects including nine foreigners and 15 Thais, with 10 individuals apprehended. Concurrently, police arrested a 35 year old Chinese national operating an SMS blaster from a van in Bangkok's Sukhumvit area. Over a three day period. The device transmitted nearly one million phishing messages, each capable of sending 100,000 texts per hour within a three kilometer radius. The fraudulent messages impersonated the Advanced Info service and urged recipients to redeem expiring points via a provided link, which then led to a phishing site designed to harvest credit card information for unauthorized transactions abroad. CyberVolk, a hacktivist group with possible Indian origins, has been active since at least March 2024 targeting state and public entities in nations opposing Russian interests. Initially known as gloriamist India, the group rebranded to Cybervolk and has claimed responsibility for compromising critical infrastructure in Japan, France and the uk. Unlike typical hacktivist groups that primarily conduct distributed denial of service attacks or DDoS attacks, CyberVolk employs ransomware and information stealing malware. Their ransomware derived from leaked source code of the Pro Russia group Azosec, demands $1,000 in cryptocurrency, with victims instructed to pay within five hours. CyberVoq's adaptability in using various ransomware families, including Hexalocker and Parano, underscores the dynamic nature of affiliations among hacktivist groups. Yesterday, on November 25, 2024, Microsoft 365 services including Outlook and Teams, experienced a significant outage affecting users globally. Reports indicated difficulties accessing emails, loading calendars and opening applications like PowerPoint. Microsoft acknowledged the issues, attributing them to a recent change impacting Exchange Online and Teams calendar functionalities. By noon Eastern time, the company reported resolving issues in approximately 98% of affected environments, though some recovery efforts faced delays. Microsoft, for its part, expressed understanding of the event's significant impact on businesses and committed to providing relief as swiftly as possible. On November 26, 2024, Wirral University Teaching Hospital NHS Trust in Northwest England declared a major incident due to a cyber attack affecting its entire network, including Aeropark, Clatterbridge and Wirral. Women and Children's hospitals. This breach led to the cancellation of all outpatient appointments and a directive for the public to use emergency services only for genuine emergencies. This marks the third significant cyber incident targeting NHS units this year, following previous attacks that disrupted services and compromised patient data. The Trust has implemented business continuity processes and is collaborating with cybersecurity experts to investigate and mitigate the breach. Trend Micro has published a report on a new strain of malware used by the Chinese state sponsored threat actor Earth Estries, also known as Salt Typhoon, to target Southeast Asian telecommunications companies. The malware, dubbed Ghost Spider, is a sophisticated multimodular backdoor designed with several layers to load different modules based on specific purposes. The backdoor is used alongside the Demodex rootkit for long term espionage operations. In addition to telecommunications companies, the group has targeted entities in the technology consulting, chemical and transportation sectors as well as government agencies and NGOs. Trend Micro says the campaign compromised more than 20 organizations across Afghanistan, Brazil, Eswatini, India, Indonesia, Malaysia, Pakistan, the Philippines, South Africa, Taiwan, Thailand, the United States and Vietnam. The researchers note that most of the victims had been compromised for several years. Essette warns that the ROM COM threat actor exploited a critical zero day affecting Mozilla products to install malware. The vulnerability CVE2024 9680, was assigned a CVSS score of 9.8 and allows vulnerable versions of Firebox, Thunderbird and the Tor browser to execute code in the restricted context of the browser. Romcom chained this flow with a Windows 0day CVE 202449 00:39 to deliver malware via malicious web pages with no user interaction required. Both vulnerabilities have since been patched. A reminder that Romcom is a Russia aligned threat actor that conducts espionage alongside cybercrime operations. In an update to a story we are following this week, on November 21, 2024, supply chain management software provider Blue Yonder experienced a ransomware attack that disrupted its managed services hosted environment. This incident affected several major clients including Starbucks and UK supermarket chains Morrison's and Sainsbury's. Starbucks faced challenges in paying baristas and managing employee schedules, while Morrisons and Sainsbury's encountered disruptions in their supply chains. Blue Yonder has engaged a cybersecurity firm to assist in investigating and restoring impacted services, but has not yet provided a specific timeline for full recovery. Google is facing a 7 billion pound or $8.8 billion class action lawsuit in the UK alleging that the company abused its dominance in the search engine market. The claim, led by Consumer Rights Advocate Nikki Stopford asserts that Google's practices, such as requiring Android device manufacturers to pre install Google Search and Chrome and paying Apple to make Google the default search engine on Safari, have stifled competition. This lack of competition purportedly led to higher advertising costs, which were then passed on to consumers. The UK's Competition Appeal Tribunal has allowed the case to proceed, marking a significant legal challenge for Google in the uk. The Cybersecurity and Infrastructure Security Agency, or cisa, has released a comprehensive report detailing a Red Team assessment conducted on a critical infrastructure organization. This assessment aimed to evaluate the organization's cybersecurity posture by simulating real world attack scenarios and key findings from the report include Initial access the Red Team gained access through SPEAR phishing emails highlighting the need for robust email security measures. Privilege Escalation Exploiting misconfigurations the team escalated privileges, underscoring the importance of proper system configurations. Lateral Movement the team moved laterally across the network using compromised credentials, emphasizing the necessity for strong access controls and data exfiltration. Sensitive data was exfiltrated without detection, indicating gaps in monitoring and data loss prevention strategies. For its part, CISA recommends organizations implement multifactor authentication, conduct regular security training, and continuously monitor network activity to mitigate such vulnerabilities. This report serves as a critical resource for organizations aiming to strengthen their cybersecurity defenses. Today, our guest is Clemence Poirier, Senior Cyber Defense Researcher at the center for Security Studies at ETH Zurich. Clemence and I recently spoke about cybersecurity attacks in space and following the interview, get some tips on how not to convince prospective customers that they should secure your services. We'll be right back.